Listen to this Post
How CVE-2026-40106 Works
CVE-2026-40106 is a heap-based buffer overflow vulnerability residing in the syscheck component of the Wazuh agent for Windows. The flaw affects versions 4.6.0 through 4.14.4 and stems from improper memory management when expanding Windows registry paths that contain wildcard characters (“ or ?).
The vulnerable code path is triggered when syscheck monitors a registry path and attempts to expand wildcards to enumerate subkeys. During this expansion, the function `w_expand_by_wildcard` in `src/shared/syscheck_op.c` allocates a fixed-size heap buffer of exactly 256 bytes (defined as OS_SIZE_256) using os_calloc(OS_SIZE_256, sizeof(char), full_path). It then constructs the full registry path by concatenating three segments: a `first_part` (the path prefix), the wildcard-expanded subkey name (query_keys), and a `second_part` (the path suffix). This concatenation is performed using unsafe `strcpy` and `strcat` calls without any length validation.
Windows registry subkeys can be up to 255 characters in length. By placing a monitored registry path under the attacker’s control and creating a subkey with the maximum allowed length of 255 characters, the total length of the concatenated string (first_part + subkey + second_part) can easily exceed the 256-byte buffer. This results in a heap-based out-of-bounds write, corrupting adjacent heap metadata.
An attacker with low privileges on the local system can exploit this by creating a maliciously named registry subkey within a path that syscheck is configured to monitor. When the agent performs its next scan and encounters this path, the overflow occurs. Since the `wazuh-agent.exe` process runs with NT AUTHORITY\SYSTEM privileges, successful exploitation can lead to a silent Denial of Service (DoS) via a `STATUS_HEAP_CORRUPTION` exception, effectively blinding the agent. Under controlled heap layout conditions, this vulnerability could also be leveraged for Local Privilege Escalation (LPE). The issue was addressed in version 4.14.5 by dynamically calculating the required buffer size based on the actual string lengths and replacing unsafe functions with `snprintf` for safe concatenation.
DailyCVE Form:
Platform: ……. Windows
Version: …….. 4.6.0 to 4.14.4
Vulnerability :…… Heap Buffer Overflow
Severity: ……. 7.8 High (NIST)
date: ………. 2026-07-16
Prediction: …… 2026-07-20
What Undercode Say: Analytics
The vulnerability is triggered in the wildcard expansion routine within the syscheck module. The following code snippets illustrate the flawed logic and the fixed implementation.
Vulnerable Code (Pre-4.14.5):
// src/shared/syscheck_op.c - w_expand_by_wildcard() char full_path = os_calloc(OS_SIZE_256, sizeof(char), full_path); // 256-byte buffer strcpy(full_path, first_part); strcat(full_path, query_keys); // subkey name (up to 255 chars) strcat(full_path, second_part); // No bounds checking - heap overflow occurs
Fixed Code (4.14.5 and later):
// Dynamically calculate required buffer size size_t full_path_len = strlen(first_part) + strlen(query_keys) + (second_part ? strlen(second_part) : 0) + 1; char full_path = os_calloc(full_path_len, sizeof(char), full_path); snprintf(full_path, full_path_len, "%s%s%s", first_part, query_keys, second_part ? second_part : "");
Crash Log Example:
2026/04/09 10:43:27 wazuh-agent[bash] syscheck_op.c:1241 at expand_wildcard_registers(): CRITICAL: (1102): Could not acquire memory due to [(12)-(Not enough space)].
Exploit
Requirements:
- Wazuh agent for Windows (versions 4.6.0 – 4.14.4) installed and running.
- Syscheck configured to monitor a registry path where the attacker can create subkeys.
- Local low-privileged user account on the target system.
Proof-of-Concept (Local):
- Identify a registry path monitored by syscheck (e.g.,
HKLM\Software\MonitoredApp). - As a low-privileged user, create a subkey with a 255-character name under the monitored path:
$longName = "A" 255 New-Item -Path "HKLM:\Software\MonitoredApp\$longName" -Force
- Trigger a syscheck scan or wait for the next scheduled scan.
- The agent will attempt to expand the wildcard, overflow the heap buffer, and crash with
STATUS_HEAP_CORRUPTION.
Expected Outcome:
- The `wazuh-agent.exe` process terminates, resulting in a Denial of Service (the agent stops reporting).
- Under specific heap layouts, the overflow may be leveraged to execute arbitrary code as SYSTEM.
- The vulnerability is not automatable remotely and requires local access.
Protection
- Upgrade to Wazuh version 4.14.5 or later immediately. This release contains the fix for CVE-2026-40106.
- If an immediate upgrade is not possible, avoid configuring syscheck to monitor registry paths that are writable by low-privileged users.
- Restrict local user permissions to limit the ability to create registry subkeys in sensitive monitored paths.
- Monitor agent logs for critical errors such as `(1102): Could not acquire memory` which may indicate exploitation attempts.
- Apply the principle of least privilege to the Wazuh agent service account; although it runs as SYSTEM, limiting exposure reduces risk.
Impact
- Confidentiality: High (potential for LPE leading to SYSTEM-level access).
- Integrity: High (attacker could modify system state or agent functionality).
- Availability: High (successful exploitation causes agent crash, resulting in silent DoS and loss of monitoring).
- Attack Vector: Local (requires authenticated user interaction).
- Attack Complexity: High (heap layout manipulation may be required for LPE).
- Privileges Required: Low (any local user can create registry keys).
- User Interaction: None.
- Scope: Unchanged.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
